#!/bin/bash
# Установка доп. по и обновление системы
apt-get install aptitude -y
aptitude update
aptitude upgrade
aptitude install krb5-user samba winbind smbfs libpam-mount -y
#resolv.conf`
rm /etc/resolv.conf
echo "nameserver 192.168.1.33" >> /etc/resolv.conf
echo "search ycm3970.local" >> /etc/resolv.conf
echo "domain ycm3970.local" >> /etc/resolv.conf
#hosts
rm /etc/hosts
echo "127.0.0.1 dbox.ycm3970.local localhost dbox" >> /etc/hosts
echo "192.168.1.33 control.ycm3970.local control" >> /etc/hosts
#ntp
ntpdate control
mkdir /home/YCM3970
#Настройка кербероса
rm /etc/krb5.conf
echo "[libdefaults]
default_realm = YCM3970.LOCAL
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
fcc-mit-ticketflags = true
[realms]
YCM3970.LOCAL = {
kdc = control
admin_server = control
default_domain = YCM3970.LOCAL
}
[domain_realm]
.ycm3970.local = YCM3970.LOCAL
ycm3970.local = YCM3970.LOCAL
[login]
krb4_convert = false
krb4_get_tickets = false" >> /etc/krb5.conf
#Настройка SAMBA
rm /etc/samba/smb.conf
echo "[global]
unix charset = UTF-8
dos charset = CP866
display charset = UTF-8
workgroup = YCM3970
server string = %h server (Samba, Ubuntu)
; У кого есть wins можете включить wins support = no
; и прописать wins сервер
; wins server = 192.168…
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
syslog = 0
panic action = /usr/share/samba/panic-action %d
# вот тут мы показываем, что используем AD
security = ads
# если стоит * то samba сама будет искать домен контроллер через dc, или же можно перечислить их IP адреса через пробел в явном виде. Или указать один #IP для того dc на котором хотите авторизоваться. Для отказоустойчивости лучше указать несколько dc или *
password server = *
#Внимание realm пишется большими буквами !!!
realm = YCM3970.LOCAL
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = yes
invalid users = root
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword :* %n\n *passwd:*password\supdated\ssuccessfully* .
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
idmap config * : range = 10000-20000
idmap config * : backend = tdb
template shell = /bin/bash
winbind enum groups = yes
winbind enum users = yes
#домашняя папку у пользователя будет в папке с именем домена. Лучше ее создать заранее вручную.
template homedir = /home/%D/%U
client use spnego = yes
winbind use default domain = yes
winbind refresh tickets = yes
restrict anonymous = 2
# строки ниже, чтобы рабочая станция не пыталась стать обозревателем в сети.
domain master = no
local master = no
preferred master = no
os level = 0" >> /etc/samba/smb.conf
/etc/init.d/winbind stop
smbd restart
/etc/init.d/winbind start
#Настройка PAM раздела
rm /etc/pam.d/common-auth
echo "auth required pam_mount.so
auth optional pam_group.so
auth sufficient pam_unix.so nullok_secure use_first_pass
auth sufficient pam_winbind.so use_first_pass krb5_auth krb5_ccache_type=FILE debug
auth required pam_deny.so" >> /etc/pam.d/common-auth
rm /etc/pam.d/common-account
echo "aaccount sufficient pam_winbind.so
account required pam_unix.so" >> /etc/pam.d/common-account
rm /etc/pam.d/common-password
echo "password sufficient pam_unix.so nullok obscure md5
password sufficient pam_winbind.so" >> /etc/pam.d/common-password
rm /etc/pam.d/common-session
echo "session required pam_winbind.so
session required pam_unix.so
session required pam_mkhomedir.so umask=0077 skel=/etc/skel
session optional pam_foreground.so" >> /etc/pam.d/common-session
rm /etc/pam.d/sudo
echo "#%PAM-1.0
auth sufficient pam_winbind.so
auth sufficient pam_unix.so use_first_pass
auth required pam_deny.so
@include common-account" >> /etc/pam.d/sudo
#Настройка nsswitch.conf
rm /etc/nsswitch.conf
echo "passwd: compat winbind
group: compat winbind
shadow: compat
hosts: files dns
networks: files dns
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: files winbind" >> /etc/nsswitch.conf
# перестартующий winbind после поднятия сети.
echo "#!/bin/sh
/etc/init.d/winbind restart" >> /etc/network/if-up.d/winbr
chmod +x /etc/network/if-up.d/winbr
/etc/pam.d/common-auth Код: auth sufficient pam_winbind.so auth required pam_unix.so nullok_secure use_first_pass /etc/pam.d/common-account Код: account sufficient pam_winbind.so account required pam_unix.so /etc/pam.d/common-password Код: password sufficient pam_winbind.so password required pam_unix.so nullok obscure min=4 max=50 md5 /etc/pam.d/common-session Код: session required pam_winbind.so session required pam_unix.so session required pam_mkhomedir.so skel=/etc/skel/ umask=0077 session optional pam_foreground.so